The recent leak of more than a hundred secret US defense documents could just be the “tip of the iceberg” of a trove of material that had started circulating long before it was widely noticed, according to a new report. The disclosure of highly classified material already represents Washington’s worst national security breach in many years, including details about Ukraine’s lack of ammunition, US intelligence collection methods used against Russia, and embarrassing evidence pointing to US spying on close allies such as Ukraine, South Korea and Israel. Analysts suggest the damage to the US could still get much worse. The spokesman for the national security council, John Kirby, said Joe Biden had been informed of the breach late last week and was being kept informed of developments. Kirby also said Washington’s allies were being consulted “at high levels”. One of the documents, dated 23 February of this year and marked secret, outlines in detail how Ukraine’s Soviet-era S-300 air defense systems would be depleted by 2 May at the current usage rate. It is unclear whether Ukraine has since changed the rate it is using S-300 missiles, whether stocks have been replenished, or whether it is now relying more on other anti-aircraft systems. The same document also refers to an intelligence source as “Lapis time-series video”, an apparent reference to a little-known and closely guarded satellite system for imaging objects on the ground. On Monday, Ukraine denied a report that it had been forced to amend some military plans ahead of a long-anticipated counter-offensive because of the leak. Presidential aide Mykhailo Podolyak said Kyiv’s strategic plans remained unchanged but that specific tactics were always subject to change. The authenticity of the documents has not been officially confirmed but the Pentagon issued a statement on Sunday saying it was reviewing the documents which “appear to contain sensitive and highly classified material”. A UK defense source said on Monday that reports – citing the documents – claiming that a Russian fighter jet nearly shot down a British surveillance plane off the coast of Crimea in September “contain inaccuracies and do not reflect what happened in international air space over the Black Sea”. Britain’s defense secretary, Ben Wallace, disclosed the incident to parliament in October and said at the time that the UK did not consider the case a deliberate escalation, but that it had been due to a technical malfunction. He also accused Moscow of acting recklessly. The document refers to the incident as a “near-shoot down of UK RJ”, a reference to the Rivet Joint moniker common for RC-135 reconnaissance planes. The investigative journalism group Bellingcat traced the leak back through a series of channels used by different internet communities, mostly involving teenagers with interests ranging from military gear, Orthodox Christianity, music and video games, all using Discord, a messaging platform popular with gamers. Racist language was common on the internet forums involved. Several Discord users told Bellingcat that the original source of the leak was a server used only by 20 people, which went by a variety of different names, most frequently Thug Shaker Central. It was set up by followers of a popular YouTuber called Oxide, who posts videos about weapons and other military paraphernalia. The sources said that the first leaks on Thug Shaker Central dated back to last October, and involved far more documents than have so far come to light. The most recent leaked documents are dated as recently as early March. The leaker allegedly was acting as the server’s administrator and set up a channel within Thug Shaker Central called “Bear vs Pig”, about the Russian invasion of Ukraine. The documents did not spread beyond Thug Shaker Central until late February, when one of the users of the “Bear vs Pig” channel, a teenager who went by the name Lucca, started posting 107 of the photographed documents on a more widely used server, WowMao, for fans of a UK-based Filipino YouTuber known for his video memes, often about European and Asian history. The founder of the Thug Shaker Central, which has since been deleted, and two of its former users, told Bellingcat that the files posted on WowMao are only the “tip of the iceberg” compared to the quantity of documents originally uploaded. “We don’t know what’s out there,” Kirby admitted on Monday. “We don’t know who’s responsible for this, and we don’t know if they have more than they intend to post. So we’re watching this and monitoring it as best we can.” A few days later, a user reposted 10 of the pictures on a Discord server for players of the Minecraft video game. They remained there apparently unnoticed for another month before a user posted three of them on a rightwing forum, 4chan, and a little later in April, five documents appeared on the Telegram messaging app. On Telegram, part of one of the documents about Ukraine was doctored to inflate Ukrainian casualties and diminish Russian casualties. The Pentagon has referred the leak to the justice department for criminal investigation. The documents have a range of classifications, including top secret and Noforn, which stands for “not releasable to foreign nationals”, suggesting the leaker is American. The documents were printed and folded, possibly to put in a pocket, before being photographed and uploaded. Another document, marked top secret from a CIA intel update from 1 March, says the Mossad intelligence agency was encouraging its officers to take part in protests against the Israeli government’s plans to weaken the independence of the judiciary. The Israeli government denied there had been any Mossad involvement in the demonstrations. One of the challenges for the leak investigation is that the Pentagon circulates such material widely, considering its sensitivity. Thousands of US staff and contractors are frequently able to get access to top secret and Noforn material. The defense department has begun a review of distribution protocols for sensitive materials as part of an overall investigation and damage assessment.